Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

adding roaring64 to fuzzer as a step toward solving issue 662 #670

Merged
merged 1 commit into from
Oct 1, 2024
Merged

adding roaring64 to fuzzer as a step toward solving issue 662 #670

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 42 additions & 1 deletion fuzz/croaring_fuzzer.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@

#include "roaring/roaring.h"

int LLVMFuzzerTestOneInput(const char *data, size_t size) {
int bitmap32(const char *data, size_t size) {
// We test that deserialization never fails.
roaring_bitmap_t *bitmap =
roaring_bitmap_portable_deserialize_safe(data, size);
Expand Down Expand Up @@ -48,3 +48,44 @@ int LLVMFuzzerTestOneInput(const char *data, size_t size) {
}
return 0;
}

int bitmap64(const char *data, size_t size) {
// We test that deserialization never fails.
roaring64_bitmap_t *bitmap =
roaring64_bitmap_portable_deserialize_safe(data, size);
if (bitmap) {
// The bitmap may not be usable if it does not follow the specification.
// We can validate the bitmap we recovered to make sure it is proper.
const char *reason_failure = NULL;
if (roaring64_bitmap_internal_validate(bitmap, &reason_failure)) {
// the bitmap is ok!
uint64_t cardinality = roaring64_bitmap_get_cardinality(bitmap);

for (uint32_t i = 100; i < 1000; i++) {
if (!roaring64_bitmap_contains(bitmap, i)) {
cardinality++;
roaring64_bitmap_add(bitmap, i);
}
}
uint64_t new_cardinality = roaring64_bitmap_get_cardinality(bitmap);
if (cardinality != new_cardinality) {
printf("bug\n");
exit(1);
}
}
roaring64_bitmap_free(bitmap);
}
return 0;
}
int LLVMFuzzerTestOneInput(const char *data, size_t size) {
int r;
r = bitmap32(data, size);
if (r) {
return r;
}
r = bitmap64(data, size);
if (r) {
return r;
}
return 0;
Comment on lines +81 to +90
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've found that the fuzzer does a better job exploring the possibility space if you have it chose between operations rather than just running multiple operations. It can better find interesting inputs for each operation, rather than wasting time running what's interesting for one operation for other operations. I think the fuzzer would be more efficient if we do something like:

if (size == 0) { return 0; }
if (data[0] % 2 == 0) {
  return bitmap32(data + 1, size - 1);
} else {
  return bitmap64(data + 1, size - 1);
}

}